Code Signing

Why Code Signing Exists

When we visit a website, we want a certain amount of verification that we're visiting the right site, and that's one of the things that TLS, transport layer security, does for us — it uses public key infrastructure. But how about when you download from the internet, when you download a program? Don't you want a certain amount of verification that that is the actual program you should be downloading and installing? That's what code signing does for us.

What It Looks Like to the End User

I'm on a demo laptop here and I've downloaded an executable. This executable is going to install a program — specifically it's installing VirtualBox, but that's not really important, I just wanted some sort of program to install to show you this code signing.

So I'm going to open this up, and it says, this is the user account control, do you want to allow this app to make changes to your device? This is the UAC on Windows, but that's not the part that is the most important to us. What we really want to look at right here is "Verified publisher: Oracle America." That is what we're really looking for here.

If I say Show more details, I can click on show information about this publisher's certificate. So we've got a certificate here, and I click on this, and here's a certificate that probably looks a little familiar to you. This is part of the public key infrastructure. So it's using public key infrastructure and digital certificates to code sign this program right here, and I can click here and scroll through and find out the different information about the certificate. It's all on this public key infrastructure with digital certificates that verifies this code is coming from the correct source.

How Code Signing Works

So what does that look like? It's very similar to digital signatures. If you looked at my material around digital signatures, it's the same sort of process, except that instead we replace it with the code or the program instead of a message.

I'm going to show you a little different view, though, because it's probably not somebody that's sending you this program. It's more likely you've gone to a site and now you're downloading this program. Let's say that TechKnowSurge developed a program and we're going to be distributing the program on the web servers, so if you go to the web servers you can download the program. This is going to represent the program right here.

First of all, what we're going to do is create a hash of the program. This is a unique fingerprint. This is a hash: we put it through our hashing algorithm, and now we've got a hash for that. What I'm next going to do is take the private key and encrypt that hash to come up with an encrypted fingerprint right there.

Now this gets handed over. When you come and download the program, you download the program with the encrypted hash and the digital certificate, and this all gets sent over to your machine. What you can do is, you have the program there, so you can create your own fingerprint using that same hashing algorithm. So now you've got a fingerprint of what the program is, and now you just need to verify that.

What you're going to do is first of all verify the certificate. I'm not going to go through that process; we just take this public key to verify this certificate. Once that certificate is verified, then we've got a certain amount of authenticity of the certificate, this trust with the certificate. Then we can take the public key on there and decrypt this fingerprint right here, and once that's decrypted it can be compared to this fingerprint. If that matches, then we know that this code came from this private key right here. So there's a certain level of verification that has just happened.

Timestamping

There is one issue with this, though, and that is that these certificates expire. As soon as this digital certificate expires, what's going to happen is that when this user tries to run this program, they're going to get a notice saying that the certificate is no longer valid.

That can cause problems in the future if we're not updating this code, or if they're not downloading new versions of this, or if there are old versions out there that we still want viable. What we're going to have to do then is something called timestamping. Timestamping allows us to timestamp this and say, well, it was valid when it was created, and so therefore it's still acceptable even into the future.

The Timestamping Authority

In order to timestamp something, we would then need a timestamping authority, or TSA. Here's our timestamping authority, very similar to our certificate authority right here.

What would happen is that we would turn over our code, our encrypted fingerprint here, and our public certificate here. We would hand it over to our timestamping authority. What they would do is create the timestamping with this, and then take all of this, to include the timestamp and the package right here, and turn it into their own fingerprint, and then encrypt this fingerprint using their own private key. So the private key would encrypt this to create this now encrypted fingerprint of the whole package.

When the user goes to download this program, it now downloads the original package, which includes the program, the encrypted fingerprint and the certificate, and also includes the timestamping authority's information: the timestamp, the encrypted fingerprint, and also the timestamping authority's certificate. So now it downloads this as one complete package right here.

First of all, it needs to verify the certificates, so it uses the root certificate to verify both of these certificates and make sure that they're valid. Once it does that, it can use the public keys to unencrypt the encrypted fingerprints here, and then it can perform its own hashing on these packages to figure out what they are and compare them to what they should be. Once it does that, now everything is verified, and it can have a certain amount of verification that this program is legitimate, with the proper timestamps from the proper timestamping authority and the proper source of the code.

That's how code signing works.